Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add fine granular permission table and column level #69

Closed
invisal opened this issue Apr 1, 2024 · 0 comments
Closed

Add fine granular permission table and column level #69

invisal opened this issue Apr 1, 2024 · 0 comments
Assignees
Milestone

Comments

@invisal
Copy link
Collaborator

invisal commented Apr 1, 2024

Each databases can have multiple roles. The role can be defined by owner. The role is stored in database_role

  • database_id: which database that the role is belonged to
  • can_execute_query: role can execute query direct to database. That's the highest level of permission because if user can send SQL to database, they can basically do anything.
  • is_owner: owner can grant other people permission.

However, if we want to define granular permission to table and column level, we will rely on database_role_permission. By default without can_execute_query, user has no permission to any table.

To grant permission to table, they can do

role access table_name column_name
table read users NULL
table write blogs NULL
table write_delete courses NULL

When user granted the table permission, they can read all columns. To limit the column permission, we can do

role access table_name column_name
table write blogs NULL
table column_deny blogs created_at
table column_read blogs created_by

We can implement this here

https://github.com/invisal/libsql-studio/blob/develop/src/app/api/database/%5Bdatabase_id%5D/ops/route.ts

You can propose on how the API look like. It should contain:

  • List permission of the role
  • Create the role
  • Change permission of the role
@invisal invisal added this to the v0.4.0 milestone Apr 1, 2024
@invisal invisal assigned invisal and rin-yato and unassigned invisal Apr 2, 2024
@invisal invisal closed this as completed Sep 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants